目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1359 元

100%

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类漏洞列表 641

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类弱点 641 条 CVE 漏洞汇总,含 AI 中文分析。

CWE-59 属于文件访问类漏洞,指程序在访问文件前未正确验证链接解析结果。攻击者常通过创建指向敏感资源的符号链接或快捷方式,诱导程序读取非预期文件,从而引发信息泄露或权限提升。开发者应避免直接使用用户输入的文件名,需在访问前校验最终解析路径,确保其位于预期的安全目录内,防止链接劫持风险。

MITRE CWE 官方描述
CWE:CWE-59 文件访问前链接解析不当('Link Following') 英文:产品尝试基于文件名访问文件,但未能正确防止该文件名标识解析到非预期资源的链接或快捷方式。
常见影响 (2)
Confidentiality, Integrity, Access Control Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
缓解措施 (1)
Architecture and Design Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CVE ID 标题 CVSS 风险等级 Published
CVE-2025-25008 Microsoft Windows 后置链接漏洞 — Windows Server 2016 7.1 High 2025-03-11
CVE-2025-25185 GPT Academic 后置链接漏洞 — gpt_academic 7.5 High 2025-03-03
CVE-2020-3432 Cisco AnyConnect Secure Mobility Client for Mac OS 后置链接漏洞 — Cisco Secure Client 5.5 - 2025-02-11
CVE-2025-21373 Microsoft Windows Installer 后置链接漏洞 — Windows 10 Version 1507 7.8 High 2025-02-11
CVE-2025-21322 Microsoft PC Manager 后置链接漏洞 — Microsoft PC Manager 7.8 High 2025-02-11
CVE-2025-21347 Microsoft Windows Deployment Services 后置链接漏洞 — Windows 10 Version 1507 6.0 Medium 2025-02-11
CVE-2025-21420 Microsoft Windows 后置链接漏洞 — Windows 10 Version 1507 7.8 High 2025-02-11
CVE-2025-21419 Microsoft Windows 后置链接漏洞 — Windows 10 Version 1507 7.1 High 2025-02-11
CVE-2025-21391 Microsoft Windows Storage Services 后置链接漏洞 — Windows 10 Version 1507 7.1 High 2025-02-11
CVE-2025-21188 Microsoft Azure 后置链接漏洞 — Azure Network Watcher VM Extension 6.0 Medium 2025-02-11
CVE-2025-0413 Parallels Desktop 后置链接漏洞 — Desktop 7.8 - 2025-02-04
CVE-2025-0146 Zoom Workplace 安全漏洞 — Zoom Workplace app for macOS 3.9 Low 2025-01-30
CVE-2025-0377 Hashicorp Go-slug 后置链接漏洞 — Shared library 7.5 High 2025-01-21
CVE-2025-21331 Microsoft Windows Installer 后置链接漏洞 — Windows 10 Version 1507 7.3 High 2025-01-14
CVE-2025-21274 Microsoft Windows Event Tracing 后置链接漏洞 — Windows 10 Version 1507 5.5 Medium 2025-01-14
CVE-2024-52050 Trend Micro Apex One 安全漏洞 — Trend Micro Apex One 7.8 High 2024-12-31
CVE-2024-12753 Foxit PDF Reader 后置链接漏洞 — PDF Reader 7.8 - 2024-12-30
CVE-2024-13043 Panda Security Dome 后置链接漏洞 — Dome 7.8 - 2024-12-30
CVE-2024-12754 AnyDesk 后置链接漏洞 — AnyDesk 5.5 - 2024-12-30
CVE-2024-12552 Wacom Center 后置链接漏洞 — Center 7.8 - 2024-12-13
CVE-2024-49107 Microsoft WmsRepair Service 访问控制错误漏洞 — Windows 10 Version 1507 7.3 High 2024-12-10
CVE-2024-49059 Microsoft Office 后置链接漏洞 — Microsoft 365 Apps for Enterprise 7.0 High 2024-12-10
CVE-2024-37143 Dell PowerFlex 后置链接漏洞 — Dell PowerFlex appliance 10.0 Critical 2024-12-10
CVE-2024-50404 QNAP Systems Qsync Central 后置链接漏洞 — Qsync Central 5.7 - 2024-12-06
CVE-2024-53691 QNAP Systems QTS和QNAP Systems QuTS hero 安全漏洞 — QTS 5.7 - 2024-12-06
CVE-2024-22038 SUSE Manager 后置链接漏洞 — openSUSE Factory 7.3 High 2024-11-28
CVE-2024-7242 Panda Security Dome 后置链接漏洞 — Dome 7.8 - 2024-11-22
CVE-2024-7241 Panda Security Dome 后置链接漏洞 — Dome 7.8 - 2024-11-22
CVE-2024-7243 Panda Security Dome 后置链接漏洞 — Dome 7.8 - 2024-11-22
CVE-2024-7240 F-Secure Total 后置链接漏洞 — Total 6.5 - 2024-11-22

CWE-59(在文件访问前对链接解析不恰当(链接跟随)) 是常见的弱点类别,本平台收录该类弱点关联的 641 条 CVE 漏洞。